topic Re: Qradar couldn't connect MM Taxii output in General Topics

Qradar couldn't connect MM Taxii output

Woranon — Fri, 02 Feb 2018 16:23:04 GMT

Hi Guys,

It seems issue happend at Minemeld side.

This is error from Qradar Threat Intell app "There is a problem connecting to the TAXII server. Verify that the TAXII server is available. Get list of collections failed."

This is error from Minemeld (/opt/minemeld/log/minemeld-web.log)

"POST /taxii-discovery-service HTTP/1.0" 200 1658 "-" "Qradar TI App/1.2.1.20170824002606"

Note: MM is run over HTTP.

Re: Qradar couldn't connect MM Taxii output

lmori — Fri, 02 Mar 2018 16:18:22 GMT

Hi @Woranon,

from my experience, the only way to debug QRadar is checking its Threat Intelligence app log from the container.

Have you already looked into it?

luigi

Re: Qradar couldn't connect MM Taxii output

Nocturnalknight — Sat, 14 Apr 2018 04:39:49 GMT

Dear woranon,

Bydefault qradar will not trust the internal CA .

As a workaround you can extract the app and disable the SSL verification.

i have already done the necessary changes in these files and its working for me. Try and let me know.

Thanks,

Ram

Re: Qradar couldn't connect MM Taxii output

TiagoSantos84 — Mon, 07 May 2018 16:23:49 GMT

Hi,

Let me ask this. And thank you in advance.

If I have a certificate (.key and .crt) that is recognized in the world, where to put in minemeld taxxi server?

Thank you!

Best Regards